API, keys and SDKs

In the developer portal, create a key for the company and select only the permissions your integration needs. Store it securely and use Test to experiment.

Do not put the secret in browser code or share it in screenshots. API access is included in the plans, but operations remain subject to modules, permissions and capacity.

401 points to request authentication. 403 means access is not allowed. Check the key, company, environment and permissions.

422 requires reviewing the fields or business rule identified in the response. 429 indicates a request limit. Respect the indicated wait and reduce frequency instead of retrying in a loop.

First check whether the previous operation completed. Use Idempotency-Key for supported operations and keep the same key when retrying the same request with the same content.

Do not reuse that key with different data. An idempotency conflict requires checking the request. The SDKs and documentation describe each operation’s contract.

Check that the key belongs to the same company and environment you are viewing in the application. Test and Live have different contexts.

Also review the identifier and document permissions. Adding permissions does not fix a reference from another company or turn test data into live data.